Privacy Policy

1. Who We Are

CREATE ("we", "us", "our") is a digital agency operating from Work Hub, Market Square, Tiverton, Devon, EX16 6FZ (UK) and Mazaya Business Avenue AA-1, JLT, Dubai (UAE). We are the data controller for any personal data collected via this website.

Questions about this policy? Email hello@createagency.uk or use the contact form.

2. What We Collect

We only collect what we need to respond to enquiries and deliver services. That includes:

• Contact details — name, email, phone, company — when you fill in a form or message us
• Enquiry details — project scope, budget, timeline and anything you tell us in your message
• Technical data — IP address, browser type, pages viewed — collected automatically via standard web logs and, if you accept cookies, analytics

3. Why We Collect It

• To reply to your enquiry and discuss your project
• To deliver services you've engaged us for
• To improve our website and user experience (anonymised analytics only)
• To comply with legal obligations (accounting, tax, etc.)

We never sell your data. We don't add you to mailing lists without explicit permission.

4. Lawful Basis

Under UK GDPR we rely on:

• Legitimate interest — responding to enquiries you initiate
• Contract — performing services you've engaged us for
• Consent — optional cookies and any marketing communications
• Legal obligation — accounting, tax and compliance records

5. Who We Share It With

We share personal data only with carefully vetted third parties strictly necessary to operate our services:

Processor	Purpose
FormSubmit	Form delivery to our inbox
Email provider (IONOS / 20i)	Hosting our business email
Google Analytics (with consent)	Anonymous website usage statistics
Meta / LinkedIn pixels (with consent)	Ad performance measurement
Our hosting provider	Serving this website

All processors are bound by contracts requiring compliance with UK GDPR and equivalent standards.

6. How Long We Keep It

• Enquiry data — up to 3 years from last contact, unless you become a client
• Client data — for the duration of our engagement and 7 years after (tax/accounting)
• Analytics data — anonymised after 26 months

7. Your Rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with the ICO

To exercise any right, email hello@createagency.uk — we'll respond within 30 days.

8. Security

We use HTTPS encryption, vetted hosting, strong password policies and 2FA on all business accounts. No system is 100% secure, but we take proportionate steps to protect your data.

9. International Transfers

Some of our processors (e.g. Google) may store data outside the UK. We only use processors that provide UK/EU-equivalent protections (UK Addendum, EU Standard Contractual Clauses, or adequacy decisions).

10. Cookies

See our separate Cookie Policy for full detail on the cookies we use and how to manage them.

11. Changes To This Policy

We update this policy as needed. Material changes will be flagged on the website. Check the "Last updated" date at the top.

12. Contact

Data protection enquiries: hello@createagency.uk
Post: CREATE Agency, Work Hub, Market Square, Tiverton, Devon, EX16 6FZ, UK.